Resource Classification Layer for Zero Trust Access Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Implementing a Zero Trust security model in telecommunications networks is challenging due to the difficulty in manually auditing extensive and varied data types, especially in networks with numerous applications generating sensitive Customer Proprietary Network Information (CPNI), leading to impractical manual solutions for enforcing security policies.
Innovation Solution
A resource classification layer using machine-learning (ML) modules or rule engines audits data types and ensures commensurate user roles are granted, blocking access to sensitive data if the requested feature's data score exceeds a sensitivity threshold, and encrypting data based on user permissions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If manual auditing of data types is used to enforce security policies, then security verification can be performed, but the process becomes impractical due to extensive and varied data types in networks with numerous applications
Solution Approach 1:
The patent replaces manual auditing with automated machine learning-based classification. The resource classification layer uses ML models to automatically categorize data types and assess sensitivity, eliminating the need for manual review while maintaining security verification reliability. This substitution of mechanical/manual processes with automated intelligent systems directly resolves the contradiction between security reliability and operational ease.
Solution Approach 2:
The system enables self-service security verification where the resource classification layer autonomously audits data types, assigns sensitivity scores, and enforces access policies without human intervention. The ML models continuously learn and adapt to new data patterns, allowing the system to self-manage security verification across extensive and varied data types generated by numerous applications.
2Reliability
If Zero Trust policy enforcement is implemented across all data access requests, then data security is enhanced, but the complexity of verifying every request increases significantly
Solution Approach 1:
The patent applies local quality by implementing differentiated security verification based on data sensitivity. The resource classification layer assigns different sensitivity scores to different data types and applies corresponding access controls. High-sensitivity data receives stricter verification while low-sensitivity data undergoes simpler checks, reducing overall system complexity while maintaining strong security where needed.
Solution Approach 2:
The system changes the parameter of security verification from a binary approved/denied decision to a continuous sensitivity score assessment. The ML models evaluate data on a spectrum of sensitivity levels, allowing for proportional security measures that match the actual risk level of each data access request, thereby reducing verification complexity while enhancing security effectiveness.
3Reliability
If extensive data types generated by numerous applications are monitored, then comprehensive security coverage is achieved, but the time and resources required for auditing increase
Solution Approach 1:
The patent implements continuous automated monitoring of data access requests through the resource classification layer. The ML models continuously process and classify data types in real-time as they are generated by numerous applications, ensuring comprehensive security coverage without manual intervention delays. This continuous automated action eliminates auditing time loss while maintaining complete security coverage.
Solution Approach 2:
The resource classification layer acts as an intermediary between data generation applications and security verification processes. The ML-based classification system automatically intercepts, categorizes, and prioritizes data access requests, reducing the time burden on security systems while maintaining comprehensive coverage of extensive data types generated by multiple applications.
Data Source
AI summary
A method is disclosed for managing access in a telecommunications network by utilizing a resource classification layer. The method involves receiving a request at a resource classification layer from a sender to obtain an access token for a receiver service. The sender is associated with a user role that has specific permissions and access rights corresponding to a data sensitivity threshold. The request includes a data payload. A classification value for the data payload is assigned using one or more resource classification models, which are trained on a log of past data payloads. A data sensitivity score is generated by comparing the classification value to a scale of classification values. The method then indicates whether the access token can be granted to the sender by comparing the data sensitivity score against the data sensitivity threshold to verify authorization.